topic Re: manage Null values in Cortex XSOAR Discussions

manage Null values

Josep — Thu, 20 Jul 2023 06:21:43 GMT

Hello,

I'm trying to create a dataframe from two lists from the context:

key1:

0:value1

1:null

2:value3

key2:

0:value1

1:value2

2:value3

When I call them using demisto.getContext(...), the null value is not passed, like if the key doesn't exist.

So my first list becomes, without a row:

key1:

0:value1

1:value3

How can I make XSOAR to detect this Null value, which appears in the context interface?

Re: manage Null values

gyldz — Thu, 20 Jul 2023 07:40:51 GMT

Hi @Josep ,

I tried to reproduce what you explained but I could not see the same results. Can you explain which commands do you use to create those lists and where do you see that list without a null value?

What I have done is as below:

1. Created a list with a null value:

!Set key=test value=`["1",null,"3"]`

2.Read the key by using GetContext command and ['1', None, '3'] is returned

print(demisto.executeCommand("getContext", {"id":incident_id})[0]['Contents']['context']['test'])

3. Created another key by using SetCommand to make sure the null value is there and it created test2 key as same as test1.

demisto.setContext("test2", demisto.executeCommand("getContext", {"id":incident_id})[0]['Contents']['context']['test'])

Re: manage Null values

Josep — Thu, 20 Jul 2023 08:52:45 GMT

It's working for you😲. These nulls values are brought at the beginning when the incident is created. In my case, when I call the variable ${incident.test1} the null indexes are deleted:

test1:

0:1

1:3

I'm using it directly at a playbook, not in an automation

Re: manage Null values

amontminy — Fri, 21 Jul 2023 17:47:49 GMT

I just tested as well, I created an incident with a field testnull and set a list with a null value for that field:

Then I ran a task in a playbook that set the context key test with the data from the testnull field:

That new test context key still contained the null value:

Re: manage Null values

Josep — Tue, 08 Aug 2023 09:39:11 GMT

Sorry for replying so late. The "null" value used is not a string @amontminy, example:

When this null value is used directly in a task conditional it doesn't detects it as an empty value. How can I check if this value is null?

Re: manage Null values

gyldz — Tue, 08 Aug 2023 10:37:20 GMT

Hi @Josep ,

You can use a transformer which is "doesn't equal "and "value -> null". Please see the example below:

Re: manage Null values

Josep — Tue, 08 Aug 2023 10:45:47 GMT

Didn't work in a conditional:

Re: manage Null values

gyldz — Tue, 08 Aug 2023 10:47:03 GMT

it should be "Doesn't Equal" operator not "Equals"

Re: manage Null values

Josep — Tue, 08 Aug 2023 10:58:32 GMT

But I would like to check if a list of dicts has a null value. If I do the oposite, "doesn't equal" it will give me the ones that have value. I just want to check if one of them is "null".

Re: manage Null values

gyldz — Tue, 08 Aug 2023 11:23:08 GMT

I understand your need now. You can do it as below. StringfyArray and use In List Operator to check if the null is in the list.

Re: manage Null values

Josep — Tue, 08 Aug 2023 11:47:32 GMT

Nope, it didn't work. It just directly avoid to convert the null to an string. So "list_with_null" with "StringifyArray" are only the ones with value, null doesn't appear.

Re: manage Null values

gyldz — Tue, 08 Aug 2023 13:22:03 GMT

Strange, It works for me. I put a condition and tested it with different cases. If I set another field with stringifyArray Transform, the null values are not stripped from the list.

Re: manage Null values

Josep — Wed, 09 Aug 2023 12:59:28 GMT

Thanks for your help,

I don't know if it could be a server configuration which treats the null values differently.

The data used is the output of an xdr incident, the initial data fetched.

Re: manage Null values

chrking — Thu, 12 Oct 2023 09:01:55 GMT

Stuff under "incident" in the context is actually an incident field and not part of the context. Instead of using demisto.getContext what do you get if you use demisto.incidents() instead?

For the conditional, I am guessing you're going to want something like: filter by Not Defined + Count transformer, then in the condition check if the result is >= 0